1. Field of the Invention
This invention relates to secure communications and in particular to, an authentication system with anonymity for devices without the use of a Trusted Third Party.
2. Description of the Related Art
In many modern communication systems, including computer networks, the reliability and security of the information being exchanged is a significant concern. For example, in the Trusted Computing Platform Alliance (TCPA) model, each computer has a trusted hardware device called a Trusted Platform Module (TPM). TPM may record information about the software and hardware environment of the computer, with each TPM having a unique endorsement key (EK). A certificate, containing information about the TPM and platform, may be issued to EK. For an outside party (Challenger) to know the software and/or hardware environment of the computer, the challenger may ask the TPM to provide a report. The challenger would have to be certain that the report is really coming from a valid TPM, while the owner of the computer would want to maintain as much privacy as possible. For example, the owner of the computer may want to be able to give reports to two different challengers without those challengers being able to determine that the reports are coming from the same TPM.
One solution proposed by TCPA was to establish Trusted Third Parties (TTP). A TPM would create an Attestation Identity Key (AIK) and would send the public portion of the key in a certificate request signed by the EK to a TTP. The TTP would check that the EK was valid, i.e., the signature was okay, and would issue a certificate for the AIK. The TPM would then use the AIK and the certificate of the TTP when the TPM received a request from a challenger. Since these would be unrelated to the EK, the challenger would get no information about the AIK. However, the problem with this approach is that it requires TTPs to be established. In practice, identifying parties that can serve as TTPs and a feasible business model for this approach has proven to be a substantial obstacle.
Furthermore, a challenger may find it useful to be able to reject transactions from a TPM that the challenger suspected of being compromised. In order to find out whether a particular TPM transaction is compromised, a challenger may want to determine which transactions are associated with a particular TPM. Furthermore, because some cryptographic protocols require extensive computation, to have a protocol constructed in such a way that the majority of the computation may be performed off-line may be useful. None of the methods, apparatus, or systems available today provide for a cryptographic protocol that achieves anonymity and security requirements along with having the capability for identifying and rejecting suspected TPMs, and is constructed in such a way that the majority of computation is performed off-line.